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INTEREST OF AMICI 

Amici are four nonprofit organizations that work to protect and defend the privacy and 
other rights of children, patients, and other consumers through research, education, and advocacy. 
The organizations are deeply concerned about both Facebook’s repeated violations of consumer 
rights and the ability of the Federal Trade Commission (FTC) to address past violations and 
prevent future ones. All four organizations have sent or supported recent complaints to the FTC 
alleging that Facebook violated consumer-protection law. A description of each organization is 
included in the motion for leave to file this brief. 1 

ARGUMENT 

This Court should reject the parties’ attempt to resolve this action with the proposed 
consent decree because the decree, as currently formulated, would not provide “overall fairness to 
beneficiaries” or reflect “consistency with the public interest.” Citizens for a Better Env’t v. 
Gorsuch, 718 F.2d 1117, 1126 (D.C. Cir. 1983) (internal quotation marks and citations omitted). 
This lawsuit involves Facebook’s repeated and flagrant violations of the FTC Act, of the 
company’s own representations to consumers about its protections of their data, and of a 2012 FTC 
order that settled eight claims that the company had used unfair practices and deceived consumers 
about its privacy protections, including by widely sharing data that the company represented would 
be kept private. See Compl., Ex. A, ECF No. 1-1 ( Facebook, Inc ., No. C-4365, 2012 FTC LEXIS 
135 (F.T.C. July 27, 2012) (decision and order)) (“2012 Order”); Compl., Ex. B, ECF No. 1-2 


1 No counsel for a party authored this brief in whole or in part, and no person other than 
the amici curiae, their members, or their counsel contributed money that was intended to fund the 
preparation or submission of this brief. 


1 
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(Complaint, Facebook, Inc., No. C-4365 (F.T.C. July 27, 2012), 2012 FTC LEXIS 136). Though 
the 2012 order prohibited Facebook from misrepresenting aspects of its privacy and data practices, 
see 2012 Order, pt. I, the company relapsed just four months after the order’s entry and began 
deceiving consumers all over again, “engaging in the very same conduct that the Commission 
alleged was deceptive” in 2012, Compl. If 9, 36, ECF No. 1. The proposed decree is insufficient 
to address Facebook’s repeated abuses of consumers’ privacy. Among other things, the 
requirements it imposes are largely procedural and the fine is too small to vindicate the agency’s 
authority or to deter a company of Facebook’s extraordinary size. 2 

This brief focuses on the most glaring problem in the proposed decree: its broad release 
clause, which could bar the FTC from pursing any claim concerning an unfair or deceptive 
consumer practice by Facebook based on information or complaints received by the agency before 
June of this year. Such a release, extending far beyond the allegations raised by the government in 
this case, is neither fair nor reasonable. Complaints that amici and others have sent to the FTC 
about two topics in particular—Facebook’s interactions with children and its handling of sensitive 
health data—show the gravity of the potential claims at stake. By signing away these and other 
potential claims, the FTC would sacrifice the possibility of government-ordered redress for 
Facebook’s wrongdoing and give up an opportunity to improve consumer protections in the social- 
media market more broadly. 


2 See generally Dissenting Statement of Commissioner Rebecca Kelly Slaughter, In the 
Matter of FTC vs. Facebook (July 24, 2019) (“Slaughter Dissent”); Dissenting Statement of 
Commissioner Rohit Chopra, In re FTC v. Facebook, Inc., Commission File No. 1823109 (July 
24, 2019) (“Chopra Dissent”). Both are available at https://www.ftc.gov/enforcement/cases- 
proceedings/092-3184/facebook-inc. 


2 
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Notably, plaintiffs motion for entry of a stipulated order offers nothing to justify the 
proposed decree’s release clause. Of course, even without the proposed release, the FTC could 
decide not to pursue unidentified Facebook violations or continue investigating such violations 
after this lawsuit concludes. But unlike an exercise of prosecutorial discretion, what the 
government and Facebook seek here—a court order forbidding FTC action—would reward 
Facebook’s recidivist conduct by giving the company a binding pass for unidentified illegal 
conduct and limiting the protections of tens of millions of United States consumers against 
unscrupulous company practices. 

I. The proposed decree would give Facebook broad immunity from potential FTC 

claims. 

The proposed decree purports to “resolve” two sets of potential claims: (1) any claim that 
Facebook violated the 2012 FTC order before June 12, 2019, and (2) all “consumer-protection 
claims known by the FTC prior to June 12, 2019, that [Facebook] violated Section 5 of the FTC 
Act.” Stip. Order for Civil Penalty, Monetary Judgment, and Injunctive Relief 1-2, ECF No. 2-1 
(“Proposed Decree”). Because this release clause would cover claims outside the scope of the 
complaint and beyond the reach of the proposed decree’s injunctive relief, it is neither fair nor in 
the public interest. 


3 
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A. The release extends to innumerable practices and far beyond the complaint’s 
allegations. 

As the FTC commissioners’ statements in connection with the agency’s approval of the 
settlement acknowledge, the breadth of the proposed release is unusual. 3 It covers a universe of 
potential claims that extends far beyond this lawsuit’s allegations about specific misrepresentations 
by Facebook about its privacy practices. 

Section 5 prohibits all “unfair or deceptive acts or practices in or affecting commerce,” 15 
U.S.C. § 45(a), not just misconduct regarding consumer-data privacy, and not only acts or practices 
involving misrepresentations, see id. § 45(n) (defining unfair practices as those involving 
substantial injury that consumers cannot reasonably avoid and that is “not outweighed by 
countervailing benefits to consumers or competition”); see generally Am. Fin. Sen’s. Ass ’n v. FTC, 
767 F.2d 957, 982 (D.C. Cir. 1985) (holding that “unfairness” is not limited to “conduct involving 
deception, coercion or the withholding of material information”). 

Moreover, because of the extraordinary variety of ways in which Facebook interacts with 
consumers, its activities could implicate either the 2012 FTC order or section 5 in innumerable 


3 See Chopra Dissent 17 (“I have not been able to find a single Commission order - 
certainly not one against a repeat offender - that contains a release as broad as this one.”); 
Slaughter Dissent 14 (concluding that “in every recent major settlement, if there was a liability 
release, it was cabined to the offenses described in the complaint”). A statement by the three 
commissioners approving the proposed decree cites two other consent decrees with releases, but 
both are limited to conduct alleged in the complaint or closely related conduct. Neither extends to 
the entirety of the defendant’s consumer business. See Statement of Chairman Joe Simons and 
Commissioners Noah Joshua Phillips and Christine S. Wilson, In re Facebook, Inc. 7 & n.10 (July 
24, 2019), available at https://www.ftc.gov/enforcement/cases-proceedings/092-3184/facebook- 
inc. 


4 
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ways. 4 Facebook operates not only through its eponymous website and mobile application, but 
also through its other social-media products (e.g., Instagram); the payments, virtual reality, virtual 
private network, and messaging companies it owns; 5 millions of third-party websites or apps that 
are integrated with Facebook in some way; 6 and the vast number of entities that advertise to 
Facebook users, promoting both legitimate products and scams. 7 The company collects data on 
billions of consumers, including most adults in the United States—both Facebook users and non¬ 
users. 8 And through the many features of its own products and the business tools it offers to third 


4 The release would cover claims against “Facebook, Inc., its successors and assigns, acting 
directly, or through any corporation, company, subsidiary, division, affiliate, website, or other 
device that it directly or indirectly controls,” as well Facebook’s officers and directors. Proposed 
Decree at 2. 

5 See Facebook, The Facebook Companies, https://www.facebook.com/help/1118145056 
50678 (last visited Oct. 14, 2019) (including links to policies that describe each Facebook 
company); Facebook, Annual Report 2018, at 5 (2019), https://s21.q4cdn.com/399680738/files/ 
doc_financials/annual_reports/2018-Annual-Report.pdf (describing consumer-facing products). 

6 In one week in 2018, 8.4 million websites included a Facebook “like” button and 2.2 
million websites used Facebook’s Pixel product to monitor how people used their website; in 2017, 
the number of apps just against which the company took “action ” numbered nearly 400,000. See 
Letter from Rebecca Stimson, Head of Public Policy, Facebook UK, to Damian Collins, Chair, 
Digital, Culture, Media, and Sport Committee, House of Commons 2, 3 (May 14, 2018), https:// 
www.parliament.uk/documents/commons-committees/culture-media-and-sport/180514-Rebecca- 
Stimson-Facebook-to-Ctte-Chair-re-oral-ev-follow-up.pdf. 

7 Regarding scammers’ use of Facebook advertisements, see generally Zeke Faux, How 
Facebook Helps Shady Advertisers Pollute the Internet, Bloomberg Businessweek (Mar. 27, 
2018), https://www.bloomberg.com/news/features/2018-03-27/ad-scammers-need-suckers-and- 
facebook-helps-find-them. 

8 See Compl. ( J[ 2. Sixty-nine percent of U.S. adults use Facebook. See Andrew Perrin & 

Monica Anderson, Share of U.S. Adults Using Social Media, Including Facebook, Is Mostly 
Unchanged Since 2018 (Apr. 10, 2019), https://www.pewresearch.org/fact- 

tank/2019/04/10/share-of-u-s-adults-using-social-media-including-facebook-is-mostly- 
unchanged-since-2018/. Facebook also receives data on individuals who are not users or logged 


5 
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parties, it interacts with these consumers electronically in countless ways, some overt and some 
not. 9 

Additionally, complaints sent to the FTC about Facebook practices implicate the 
Children’s Online Privacy Protection Act (COPPA) and the FTC’s health breach notification 
rule—both of which state that violations of those provisions shall be considered violations of an 
FTC rule prohibiting unfair or deceptive acts or practices. See 15 U.S.C. § 6502(c) (COPPA); 16 
C.F.R. § 318.7 (health breach notification rule, implementing section 13407(e) of the American 
Recovery and Reinvestment Act of 2009, Public Law No. 111-5, 123 Stat. 115). The release clause 
does not specify whether it covers claims under COPPA, the health breach notification rule, or 
other statutes or rules with similar references to the FTC’s authority, see, e.g., 12 U.S.C. 
§ 558 l(b)(5)(C)(ii) (example of another statute stating that violations of other consumer-protection 
rules shall be treated as violations of an FTC unfair or deceptive acts or practices rule). Both that 
ambiguity and the possibility that the release extends to such claims further highlight the potential 
breadth of the proposed decree. 


into its system. See David Ingram, Facebook Fuels BroaclPrivacy Debate by Tracking Non-Users, 
Reuters (Apr. 15, 2018), https://www.reuters.com/article/us-facebook-privacy-tracking/facebook- 
fuels-broad-privacy-debate-by-tracking-non-users-idUSKBNlHMODR; Sam Schechner and 
Mark Secada, You Give Apps Sensitive Personal Information. Then They Tell Facebook, Wall St. 
J. (Feb. 22, 2019), https://www.wsj.com/articles/you-give-apps-sensitive-personal-information- 
then-they-tell-facebook-11550851636. 

9 See, e.g., Schechner & Secada, You Give Apps, supra n.8 (regarding data-sharing through 
apps that are not overtly tied to Facebook); see generally Facebook for Developers, Tools to Scale 
Your Business, https://developers.facebook.eom/products#business-tools (last visited Oct. 14, 
2019) (describing Facebook offerings to application developers). 


6 
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The problems with the breadth of the release are not hypothetical. Facebook’s business 
practices have persistently generated questions about misconduct. For example, in a public 
statement opposing the settlement, one FTC commissioner stated that “[hjardly a week passes 
without a news story revealing some potentially illegal conduct by Facebook.” Slaughter Dissent 
15. Indeed, in the first half of 2019 alone, journalists reported on a number of troubling concerns 
about Facebook’s consumer practices: a function in a Facebook product that allowed children to 
“chat” with unauthorized adults; Facebook’s practice of paying teens for access to their online 
data; Facebook’s ad algorithms discriminating by race and gender; and Facebook’s collection of 
sensitive health data that consumers input into mobile apps without knowing that they are linked 
to Facebook on the back end. 10 Also this year, Facebook has been investigated or sued for 
unauthorized collection of users’ email address books and for discrimination related to the 
advertising it hosts. 11 


10 See Russell Brandom, Facebook Design Flaw Let Thousands of Kids Join Chats with 

Unauthorized Users, Verge (July 22, 2019), https://www.theverge.eom/2019/7/22/ 

20706250/facebook-messenger-kids-bug-chat-app-unauthorized-adults; Josh Constine, Facebook 
Pays Teens to Install VPN That Spies on Them, TechCrunch (Jan. 29, 2019), 
https://techcrunch.com/2019/01/29/facebook-project-atlas/; Karen Hao, Facebook’s Ad-Ser\’ing 
Algorithm Discriminates by Gender and Race, MIT Tech. Rev. (Apr. 5, 2019), 
https://www.technologyreview.eom/s/613274/facebook-algorithm-discriminates-ai-bias/; 
Schechner & Secada, You Give Apps, supra n.8. 

11 See Brakkton Booker, Housing Department Slaps Facebook with Discrimination 
Charge, NPR (Mar. 28, 2019), https://www.npr.org/2019/03/28/707614254/hud-slaps-facebook- 
with-housing-discrimination-charge; Mike Isaac, New York Attorney General to Investigate 
Facebook Email Collection (Apr. 25, 2019), https://www.nytimes.com/2019/04/25/ 
technology/facebook-new-york-attomey-general-investigation.html; see also Nat Ives, Facebook 
Axes Age, Gender and Other Targeting for Some Sensitive Ads, Wall St. J. (Mar. 19, 2019), 
https://www.wsj.com/articles/facebook-axes-age-gender-and-other-targeting-for-some-sensitive- 
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The proposed decree would not remedy many of these and other potential problems with 
Facebook’s practices, but would release section 5 claims concerning them if they were known to 
the FTC or claims that these practices violated the 2012 FTC order. In particular, complaints about 
Facebook’s treatment of children and its handling of health data, including complaints submitted 
by amici, raise concerns that could fall under the proposed decree’s release clause and that illustrate 
the problems with awarding Facebook such a broad release. 

1. Complaints about Facebook practices that target children 
In 2017, Facebook launched Messenger Kids, a social-media product targeting children. 12 
This product raised multiple concerns about harm to children. In 2018, dozens of individual experts 
and organizations called on the company to discontinue the product, warning that “a growing body 
of research demonstrates that excessive use of digital devices and social media is harmful to 
children and teens, making it very likely this new app will undermine children’s healthy 
development.” 1 ' 1 Then, citing this warning, amici Campaign for a Commercial-Free Childhood, 
Public Citizen, and U.S. Public Interest Research Group (U.S. PIRG), along with other groups, 
urged the FTC to investigate Facebook for several alleged abuses. Noting that it was easy to create 


ads-11553018450 (regarding settlement of some ad-related discrimination lawsuits against 
Facebook). 

12 See Associated Press, Facebook Launches Messenger Kids App, Wash. Post. (Dec. 4, 
2017), https://www.washingtonpost.com/lifestyle/kidspost/facebook-launches-messenger-kids- 
app/2017/12/04/05d233d6-d924-l le7-bla8-62589434a581_story.html. 

13 Letter from Campaign for a Commercial-Free Childhood, el al. to Mark Zuckerberg, 
CEO, Facebook, Inc., at 1 (Jan. 30, 2018), http://www.commercialfreechildhood.org/ 
sites/default/files/devel-generate/gaw/FBMessengerKids.pdf (with signatories including 
Campaign for a Commercial-Free Childhood, Common Sense Media, and Public Citizen). 
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a fake account to “approve” a child’s access, they asserted that Messenger Kids was violating 
COPPA by collecting personal information from children without verifiable parental consent. 
They also expressed concern that Facebook was not adequately disclosing its Messenger Kids 
privacy policies or ensuring their compliance with COPPA. 14 For example, though COPPA limits 
the period that websites can retain children’s information to the time needed to fulfill its original 
purpose, see 16 C.F.R. § 312.10, the Messenger Kids privacy notice does not state such a 
limitation. 15 Further, the notice does not name “all operators collecting or maintaining personal 
information from children through the Web site or online service,” 16C.F.R. § 312.4(d)(1), instead 
making only vague reference to disclosures within Facebook’s “family of companies” or to 
“service providers”—a universe that could mean Facebook is sharing young children’s personal 
information, including their photos and videos, with numerous unidentified entities and their 
employees. 16 

In 2019, amicus Common Sense Media, joined by amici Campaign for a Commercial-Free 
Childhood and Public Citizen and other groups, pressed the FTC to investigate the company’s 


14 See Letter from James T. Graves and Angela J. Campbell, Institute for Public 
Representation, to Donald S. Clark, Secretary of the Commission, and Andrew Smith, Director, 
Bureau of Consumer Protection, FTC (Oct. 3, 2018), https://www.commercialfreechildhood.org/ 
sites/default/files/devel-generate/wab/FTC%20FB%20Messenger%20Kids%20Letter.pdf. 

15 See Letter from James T. Graves and Angela J. Campbell, supra n.14. In pertinent part, 
the Facebook Messenger Kids privacy notice remains the same as it was at the time of the 
complaint. See Facebook, Messenger Kids Privacy Policy, https://www.facebook.com/legal/ 
messengerkids/privacypolicy (with date of last revision remaining December 4, 2017). 

16 See Letter from James T. Graves and Angela J. Campbell, supra n.14, at 4-5. 
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other interactions with children after documents revealed “that for years ... Facebook maintained 
a system that encouraged children to make unknowing and unauthorized credit card purchases for 
virtual items in games on Facebook’s platform.” 17 Pointing out that a class-action settlement 
involving these practices had provided incomplete relief and was expiring earlier this year, the 
organizations urged the FTC to investigate whether the company’s billing conduct was an unlawful 
unfair practice. Further, they asked the agency to investigate whether Facebook had violated 
COPPA or improperly handled minors’ data by making third-party apps available to children 
younger than age 13. 18 

These concerns are serious. Through COPPA, Congress has recognized that children under 
age 13 warrant special protection when using the internet. The statute and its implementing 
regulations require websites and online services directed at such young children to obtain verifiable 
parental consent before collecting or using children’s personal information and mandate other 
safeguards related to such data. See generally 15 U.S.C. §§ 6501-6506; 16 C.F.R. pt. 312. 
Moreover, billing parents for children’s in-app activities, without proper controls, can cause direct 
financial harm, and the FTC has repeatedly taken the position that the practice is unfair, filing and 
settling related claims. See Apple Inc., No. C-4444, 2014 WL 1330287, at *5 (F.T.C. Mar. 25, 


17 Letter from Common Sense Media, et al. to Donald S. Clark, Secretary of the 
Commission, and Andrew Smith, Director, Bureau of Consumer Protection, FTC, at 1 (Feb. 21, 
2019), http://d2e 11 ljql 3me7 3 .cloudfront.net/sites/default/files/uploads/2.21.19_fbftcletter.pdf; 
see generally Nathan Halverson, Facebook Knowingly Duped Game-Playing Kids and Their 
Parents Out of Money, Reveal (Jan. 24, 2019), http://www.revealnews.org/article/facebook- 
knowingly-duped-game-playing-kids-and-their-parents-out-of-money. 

18 See Letter from Common Sense Media, supra n.17, at 2-6. 
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2014); Google Inc., No. C-4499, 2014 WL 6984156, at *5-6 (F.T.C. Dec. 2, 2014); see also FTC 
v. Amazon.com, Inc., No. C14-1038-JCC, 2016 WL 10654030, at *8-11 (W.D. Wash. July 22, 
2016) (granting summary judgment to the FTC on Amazon’s liability under section 5 for in-app 
billing practices). Additionally, Facebook’s Messenger Kids and in-app billing-practices are not 
the only instances in which “Facebook has demonstrated a lack of care toward young people.” 19 
In urging the FTC to investigate Facebook’s in-app billing, groups enumerated reports of other 
troubling Facebook practices, such as its efforts to pay teenagers for access to data on their phones 
and its research concerning the possibility of targeting ads to teenagers feeling down. 20 

2. Complaints about Facebook’s solicitation and exposure of health data 
The FTC has also received complaints about Facebook’s efforts to attract and use health 
data. The data often comes through the circles of Facebook members—or “groups”—that 
individual users can form on the company’s website. More than a decade ago, users started creating 
such groups to discuss issues related to particular health conditions. 21 Some medical experts advise 


19 Letter from Common Sense Media, supra n.17, at 6. 

20 See id. (citing Josh Constine, Facebook Pays Teens to Install VPN That Spies on Them, 
TechCrunch (Jan. 29, 2019), https://techcrunch.com/2019/01/29/facebook-project-atlas/, and Nick 
Whigham, Leaked Document Reveals Facebook Conducted Research to Target Emotionally 
Vulnerable and Insecure Youth, News Corp Australia (May 1, 2017), www.news.com.au/ 
technology/online/social/leaked-document-reveals-facebook-conducted-research-to-target- 
emotionally-vulnerable-and-insecure-youth/news-story/d256f850be6blc8a21aec6e32dael6fd). 

21 See Jacqueline L. Bender, Maria-Carolina Jimenez-Marroquin, and Alejandro R. Jadad, 
Seeking Support on Facebook: A Content Analysis of Breast Cancer Groups, J. Med. Internet Res. 
(Jan.- Mar. 2011), https://www.jmir.Org/2011/l/el6/. 
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that patients and caregivers may benefit from the support and community they find online. 22 News 
reports suggest, however, that Facebook has looked to the groups—and users’ participation in 
them—to serve its advertising-centric business model. In 2014, the company explored the creation 
of online support communities and health-related applications after “Facebook executives ... 
[came] to realize that healthcare might work as a tool to increase engagement with the site.” 23 
Now, reportedly, many health-related Facebook groups are “sponsored or supported by drug 
companies.” 24 “Ensuring that these groups are active and vibrant could help Facebook as it 
increasingly looks to health care and pharmaceutical companies for advertising.” 25 

In December 2018, patients and data experts sent a lengthy complaint to the FTC regarding 
Facebook’s health support-group practices. 26 The complaint explained that even membership in a 


22 See, e.g., Nat’l Cancer Inst., Cancer Support Groups (Jan. 24, 2019), 
https://www.cancer.gov/about-cancer/coping/adjusting-to-cancer/support-groups; Mayo Clinic, 
Support Groups: Make Connections, Get Help (June 2, 2018), https://www.mayoclinic.org/ 
healthy-lifestyle/stress-management/in-depth/support-groups/art-20044655. 

23 Christina Farr and Alexei Oreskovic, Exclusive: Facebook Plots First Steps into 

Healthcare , Reuters (Oct. 3, 2014), https://www.reuters.com/article/us-facebook-health/ 

exclusive-facebook-plots-first-steps-into-healthcare-idUSKCN0HS09720141003. 

24 Christina Farr, Facebook Will Allow Patients in Support Groups to Post Questions 
Anonymously, CNBC (Apr. 30, 2019), https://www.cnbc.com/2019/04/30/facebook-adds-health- 
support-groups-with-anonymous-posting.html. 

25 Id.; see cdso Christina Farr, Facebook Is Making a Big Push This Summer to Sell Ads to 
Drugmakers, CNBC (May 26, 2017), https://www.cnbc.com/2017/05/26/facebook-health- 
summit-june-6-will-focus-on-pharma-cannes-to-follow.html. 

26 See Letter from Fred Trotter, el al. to FTC (Dec. 14, 2018), https://missingconsent.org/ 
downloads/SicGRL_FTC_Compliant.pdf; see also Emily Birnbaum, Patients, Health Data 
Experts Accuse Facebook of Exposing Personal Info, Hill (Feb. 19, 2019), https://thehill.com/ 
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group, such as a cancer support-group or an HIV-positive group, can communicate sensitive health 
information, and that within a Facebook group, users may share many more details about their 
conditions as they seek information and support. 27 It expressed concern that Facebook markets 
health support-groups to users without making clear the extent to which such sensitive data can be 
exposed or taking steps to limit such exposure. For example, the complaint explained that 
mismatches between the company’s privacy statements and those of group administrators can 
mislead consumers about the privacy of their data. 28 It also provided information indicating that 
Facebook practices unduly expose users to the sharing and misuse of their health data. It described 
how a patient advocate and a security researcher discovered that Facebook allowed group data to 
be downloaded in bulk by individuals who were not members of a group, and alleged that 
Facebook violated the FTC’s health breach notification rule, 16 C.F.R. pt. 318, by not treating 
such a bulk download of health-group data as a reportable breach. 29 Further, the complaint pointed 
out that even after Facebook eliminated that vulnerability in its software, Facebook-hosted health 
data remains susceptible to exploitation by those who took advantage of the earlier software flaw, 


policy/technology/430634-patients-health-data-experts-accuse-facebook-of-exposing-personal- 

health. 

27 See Letter from Fred Trotter, et al., supra n.26, at 16-18, 28. 

28 See id. at 12-15, 36. 

29 See Letter from Fred Trotter, et al., supra n.26, at 6, 16-18, 25-29, 38-39. 
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by scammers posing as users seeking to join a group and download group information, or by apps 
given access to groups by their administrators. 30 

Exploitation of health or similarly sensitive data can put consumers at risk of privacy 
invasions and other harms. Marketers and scammers can take advantage of patients and caregivers, 
preying on their vulnerabilities for profit or harassment. For example, members of one addiction 
support-group found themselves targeted for addiction-treatment sales pitches; it turned out that 
the group, which Facebook had praised in its own materials, was the marketing arm of a treatment 
center that used the group to fish for leads. 31 In another case, a Facebook group for sexual 
harassment survivors was taken over by internet trolls who advertised it for sharing erotica and 
threatened survivors with contacting their abusers, calling child protective services about their 
children, or releasing their stories. 32 Additionally, as insurers scour social media and other sources 
for data, they might use Facebook users’ information against them, in pricing or in other ways 


30 See id. at 14 & n.l, 22-24, 30-33. 

31 See id. at 33; Cat Ferguson, Predatory Behavior Runs Rampant in Facebook’s Addiction 
Support Groups, Verge (May 21, 2018), https://www.theverge.eom/2018/5/21/17370066/ 
facebook-addiction-support-groups-rehab-patient-brokering. 

32 See Fouise Matsakis, How a Facebook Group for Sexual Assault Survivors Became a 
Tool for Harassment , Wired (July 19, 2018), https://www.wired.com/story/how-a-metoo- 
facebook-group-became-harassment-tool/. 
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those consumers may never anticipate. 33 Patient advocates also worry that health information 
leaked from Facebook groups could put some individuals at risk of physical attack. 34 

The complaint regarding Facebook’s unscrupulous treatment of individuals with health 
issues asserts a range of violations: violation of the 2012 FTC order, violation of the health breach 
notification rule, and unfair or deceptive practices. Importantly, some of the alleged practices are 
similar to others the FTC has pursued as unfair. For example, the FTC has used section 5’s 
prohibition on unfairness to pursue companies for failing to protect user data against hackers or 
other unauthorized users. See FTC v. Wyndham Worldwide Corp., 799 F.3d 236, 240-41 (3d Cir. 
2015); LabMD, Inc. v. FTC , 776 F.3d 1275, 1277 (11th Cir. 2015); Compl. fj[ 54-56, FTC v. Ruby 
Corp., No. l:16-cv-02438 (D.D.C. filed Dec. 14, 2016); CardSystems Sols., Inc., No. C-4168, 
2006 WL 2709787, at *1-2 (F.T.C. Sept. 5, 2006). Similarly, it has pursued companies for unfairly 
exposing their customers to scammers. See, e.g., Compl. ( f][ 71-73, FTC v. Match Group, Inc., No. 
3:19-cv-02281-K (N.D. Tex. filed Sept. 25, 2019) (alleging that online dating service unfairly 


33 See generally Marshall Allen, Health Insurers Are Vacuuming Up Details About You — 
And It Could Raise Your Rates, ProPublica (July 17, 2018), https://www.propublica.org/article/ 
health-insurers-are-vacuuming-up-details-about-you-and-it-could-raise-your-rates (describing 
how insurance companies “vacuum up personal details about hundreds of millions of Americans,” 
including by collecting social media posts, which they feed into pricing algorithms); cf. Mohana 
Ravindranath, How Your Health Information Is Sold and Turned Into ‘Risk Scores ’, Politico (Feb. 
3, 2019), https://www.politico.com/story/2019/02/03/health-risk-scores-opioid-abuse-l 139978 
(describing how companies like LexisNexis have started creating opioid-related risk scores, based 
on their “hoovering up” of data from multiple sources). 

34 See Letter from Fred Trotter, et al., supra n.26, at 1, 28-29, 33; cf. Kristine Phillips, 
Grindr Says It Will Stop Sharing Users ’ HIV Data with Third-Party Firms Amid Backlash (Apr. 
3, 2018), https://www.washingtonpost.com/news/to-your-health/wp/2018/04/03/grindr-says-it- 
will-stop-sharing-users-hiv-data-with-third-party-firms-amid-backlash/ (mentioning concern that 
another internet company’s sharing of HIV status could put users at risk). 
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exposed consumers to risk of fraud through communications that the company knew were likely 
sent by scammers); FTC v. MoneyGram Int’l, Inc., No. l:09-cv-06576 (N.D. Ill. Nov. 13, 2018), 
ECF No. 20 (“MoneyGram Order”) (stipulated order settling claims that money transfer company 
violated prior order addressing actions exposing customers to fraud); see also Compl. ( J[ ( J[ 83-84, 
FTC v. MoneyGram Int’l, Inc., No. l:09-cv-06576 (N.D. Ill. Oct. 19, 2009), ECF No. 1 (unfairness 
claim). 

B. The proposed consent decree’s injunctive provisions fail to redress complaints 
that the FTC has received about alleged Facebook violations. 

The proposed decree’s release clause purports to “resolve” amici’s and others’ complaints 
of 2012 order violations or unfair or deceptive practices that were known to the FTC, and would 
thus prevent further FTC action addressing them. The decree, however, would do nothing to 
remedy many of the alleged violations described in the complaints or to prevent them from 
recurring. The proposed decree, for example, includes no limitations on Facebook’s billing for 
children’s in-app purchases. The decree also does not direct Facebook to implement specific 
measures to protect vulnerable patients from scammers or limit its handling of health data. 

If the parties sought to remedy amici’s and others’ concerns about health data and 
Facebook’s engagement with children, there are many injunctive measures they could consider. 
For example, to redress and prevent future unfair in-app billing practices, a consent decree might 
require Facebook to (1) refund injured consumers; (2) seek re-entry of credit card numbers at 
pertinent junctures, making it harder for children to incur charges; or (3) use analysis of credit- 
card chargeback rates to identify and address when children are likely being led unwittingly into 
charges. Indeed, settlement agreements in other FTC in-app billing cases have included some such 
measures, and Facebook earlier identified others of these potential safeguards, but declined to 
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adopt them out of fear of lost revenue. See Apple Inc., No. C-4444, 2014 WL 1330287, at *7-8 
(F.T.C. Mar. 25, 2014) (ordering Apple to refund certain in-app charges incurred by minors and 
to obtain express consent for billing of in-app charges); Google Inc., No. C-4499, 2014 WL 
6984156, at *8-9 (F.T.C. Dec. 2, 2014) (similar); Halverson, Facebook Knowingly Duped Game- 
Playing Kids and Their Parents Out of Money, supra n.17 (discussing Facebook consideration of 
measures). In this case, however, the proposed decree would do none of these things. 

To address Facebook’s targeting of young children through games or Messenger Kids, the 
proposed decree might also include provisions such as: (1) a requirement that Facebook verify 
parental consent before permitting account-holders to add apps attracting children; (2) restrictions 
on the period of time Facebook can hold children’s data or the types of entities with which 
Facebook can share such data; (3) a mandate to comply with COPPA, including the requirement 
to name entities receiving children’s information, see 16 C.F.R. § 312.4(d)(1). The decree could 
also enumerate extra security or privacy protections for accounts that Facebook concludes are 
likely being used by children. But the proposed decree would do none of these things. 

The decree could also put in place a strong remedy for the problems alleged by the health 
advocates’ complaint. It might include such requirements as: (1) restrictions on group 
administrators’ ability to allow others to access users’ health data; (2) restrictions on 
administrators’ representations about privacy in their groups; or (3) limits on the amount of 
sensitive health information that Facebook can receive, store, or share. A consent decree could 
also limit Facebook’s relationships with health-related companies, to remediate or prevent 
exploitation of consumers by scammers buying health-related ads or participating in health 
support-groups. Cf. MoneyGram Order 7-22 (prescribing detailed requirements for money transfer 
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company to prevent and address fraudsters’ use of the company’s platform). 35 The proposed decree 
would not impose any of these safeguards, though. 

Finally, given the particular sensitivity of health-related data as well as data involving 
children, the FTC could push the company to delete existing children’s data and health data, absent 
express consent to the contrary, and to start afresh, under a cleaned-up privacy and security 
program. Indeed, the proposed decree takes just such an approach to another sensitive category of 
data: the facial-recognition templates that the government alleges Facebook deceptively collected. 
See Proposed Decree, Att. A, pt. VI. With regard to Facebook practices targeted at children or 
health data, however, the proposed decree would not require such measures. 

Notably, the decree makes brief references to children and to health-related issues, but 
these acknowledgments would not address all of amici’s and others’ concerns. The decree 
mentions children and health only as examples of topics implicating privacy concerns. See 
Proposed Decree, Att. A, at Definitions § B.8 (defining the tenn “ordinary consumers” to include 
children or terminally ill individuals, in the context of a representation or practice targeted at such 
an audience); id. pt. VII, § E.2.b (listing practices involving health data or products directed at 
minors as examples of those that present a material risk to the privacy, confidentiality, or integrity 
of consumer information). Though the proposed decree includes general privacy-evaluation 


35 Facebook recently announced that it will permit individuals to pose questions in health 
support-groups anonymously, by sending such questions to administrators. But without a court 
order, this practice is voluntary and subject to change. Further, as reported in the press, this practice 
does not appear to limit the sensitive data that is available to group “administrators” or that can be 
used by advertisers or others. See Megan Thielking, Facebook Announces New Steps in Effort to 
Allow Users to Ask Health Questions Anonymously, Stat (Apr. 30, 2019), https://www.statnews. 
com/2019/04/30/facebook-new-steps-privacy-health-data/. 
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requirements, see Proposed Decree, Att. A, pts. VII-X, and a mandate to establish “appropriate” 
information-security “safeguards,” id. pt. V, these general requirements do not encompass the 
range of potentially unlawful conduct that amici and others have identified or establish express 
limits, such as the ones described above, on the company’s interactions with children or its 
treatment of health data. Moreover, some of the proposed decree’s general provisions, related to 
“covered third parties,” leave a potential gap in Facebook’s treatment of group administrators or 
other system users who may gain access to sensitive health data through other users themselves. 
The proposed decree defines “Covered Third Party” based on the use or receipt of certain 
information “ outside of a User-initiated transfer.” Proposed Decree, Att. A, at Definitions § E 
(emphasis added). This exception, although unclear, could be read to apply to communication 
through a health support-group. Thus, for example, while the proposed decree would require 
certification from any Covered Third Party regarding its compliance with Facebook policies, see 
id. pt. VII, § E.l, and notifications about material changes in the company’s sharing with such 
parties, see id. pt. II, it would not necessarily require such certifications regarding handling of 
group content, cf. Facebook, Community Standards , https://www.facebook.com/ 
communitystandards/introduction (last visited Oct. 14, 2019) (Facebook’s general standards about 
what it allows on its site), or notices of material changes in the types of data made available to 
other users. 

II. Because of its broad release clause, the proposed decree is unfair, unreasonable, 

inadequate, and inconsistent with the public interest. 

Because of the breadth of the release, the proposed decree is far from “fair, adequate, 
reasonable and appropriate under the particular facts.” Citizens, 718 F.2d at 1126 (citation 
omitted). As an initial matter, it does not “incorporate[] concepts of corrective justice and 
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accountability.” United States v. Hyundai Motor Co., 77 F. Supp. 3d 197, 199 (D.D.C. 2015) 
(citation omitted) (holding that incorporation of such concepts is necessary for a consent decree to 
be substantively fair). Here, rather than holding Facebook accountable for its violations, the 
government has proposed excusing the company for violations without even identifying them, let 
alone addressing or penalizing each one. 

The lack of transparency built into the release makes it particularly unjust, because of the 
nature of the claims in this case. At bottom, the government’s complaint suggests that Facebook 
has built a business on duping consumers into giving it extensive personal data, based on false 
promises about how it protects privacy. See generally Compl. 3-4; Chopra Dissent 2 (“In many 
ways, Cambridge Analytical scheme was a small-scale reflection of Facebook’s own tactics of 
tricking users into sharing excessive amounts of personal data and then getting paid by third parties 
to target individual users.”). Even after being ordered in 2012 to stop its deceptive practices, 
Facebook allegedly continued to violate the rights of tens of millions of U.S. consumers by sharing 
data it represented would be kept private, failing to share information with the independent privacy 
assessor required by the FTC’s 2012 order, and misrepresenting its handling of phone-number and 
facial-recognition data. See Compl. ( J[ ( J[ 7-14. Such unlawful opaqueness should not be rewarded 
with a court order that sweeps under the rug even more information about other acts and practices 
that the FTC knows may have violated the law. 

In light of the broad release, the consent decree also fails to measure up to the standard of 

adequacy, reasonableness, and appropriateness. “When assessing whether [a] consent decree” 

satisfies this standard, “courts focus on the extent to which the decree is confined to the dispute 

between the parties and whether the decree adequately accomplishes its purported goal.” Hyundai 

Motor Co., 77 F. Supp. 3d at 200 (internal quotation marks and citation omitted). Here, far from 

20 



Case l:19-cv-02184-TJK Document 22-1 Filed 10/15/19 Page 30 of 33 


being “confined to the dispute between the parties,” icl., the proposed decree would give Facebook 
a pass on an untold number of past violations, of unknown breadth and consequence. For this 
reason, the decree is very different from typical consent decrees. See, e.g., Appalachian Voices v. 
McCarthy, 38 F. Supp. 3d 52, 56 (D.D.C. 2014) (approving consent decree when its “scope ... is 
limited to the sole remaining issue in [the] litigation”); Home Builders Ass ’ns ofN. Cal. v. Norton, 
293 F. Supp. 2d 1, 4 (D.D.C. 2002) (in approving consent decree settling claims about a habitat 
designation for a particular species, noting that the decree would “in no way disturb” other 
protections for that species); cf. 4 William B. Rubenstein, Newberg on Class Actions § 13:61 (5th 
ed. 2019) (explaining that because of limits on claim preclusion, in class actions, “courts often 
police a proposed settlement agreement to ensure that the release is not overly broad, that is, that 
it does not release claims outside the factual predicate of the class’s claims”). 

The breadth of the release also raises questions about the adequacy of other parts of the 

proposed decree. Without more information from the parties, the Court cannot know the number 

or substance of any known potential claims that are being released or the severity and breadth of 

the conduct at issue. Such information could be important to evaluating other aspects of the 

proposed decree. For example, in support of the proposed $5 billion fine, the government treats 

each of the “approximately 900 million views of Facebook webpages containing allegedly 

deceptive statements about data privacy” as a violation of the 2012 order and compares the per- 

violation amount of the fine to the per-violation amounts of the fines imposed in other cases. See 

PL’s Consent Motion 4, ECF No. 2. But if the proposed decree aims to settle other, known—but 

unidentified—violations of the 2012 order, the government’s estimate of the per-violation fine 

necessarily is too low. To the extent a per-violation comparison matters, what the government and 

this Court should evaluate is the size of the fine across all the 2012 order violations identified by 
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the FTC, not some subset that the parties agreed could be listed publicly in a complaint. See 
generally U.S. Dep’t of Justice v. Daniel Chapter One , 89 F. Supp. 3d 132, 148-49 (D.D.C. 2015) 
(listing five factors that courts consider in determining appropriate civil penalties for violations of 
FTC orders, but not mentioning per-violation amount), aff’d , 650 F. App’x 20 (D.C. Cir. 2016) 
(per curiam). Similarly incomplete is the government’s argument that the settlement “addresses 
the issues that gave rise to the FTC investigation in a fair and efficient manner.” Pl.’s Consent 
Motion at 6 (emphasis added). Again, information about the scope of the “resolved” claims that 
are known to the FTC is necessary for the Court to evaluate whether the proposed decree addresses 
issues fairly and efficiently. 

In addition, the proposed release is inconsistent with the public interest because of the ways 
in which it increases, rather than decreases, consumers’ risk of being harmed online by Facebook 
and other companies. As an initial matter, by giving up the FTC’s enforcement rights, the proposed 
release limits consumers’ ability to receive redress for Facebook’s wrongdoing. Individuals have 
no private right of action under the FTC Act, and thus depend on the FTC for enforcement of the 
2012 order and section 5. Moreover, even when individuals have causes of action to pursue, they 
may face hurdles that the government would not. Deception claims, by definition, involve actions 
that consumers do not accurately understand and thus may not be able to identify for legal action. 
And even when consumers learn of harmful Facebook practices, they may not be able to investigate 
and address violations as efficiently as the government, which can proceed through FTC 
administrative proceedings or in court, can use mandatory processes to investigate violations even 
before the start of litigation, and can seek relief for consumers nationally, without the hurdles of 
class certification. See 15 U.S.C. §§ 45(b), (m), 46(a), (b), 53(b), 57b(a), 57b-l. 
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Further, the release limits consumers’ abilities to pursue self-help remedies. If the parties 
revealed the additional Facebook violations (or potential violations) that the release “resolves,” 
that information could empower individuals to take steps to protect themselves. They might 
change, for example, how they share information within health support-groups or whether they 
permit their children to use Messenger Kids. Absent that information through this lawsuit, 
consumers might not even learn of the need to take protective action. 

The release could also increase the risk that consumers will suffer harm from other 
companies. When they identify and address violations, the FTC’s enforcement actions can be an 
important signal to other market participants about what the FTC considers necessary to protect 
consumers and avoid unfair or deceptive practices. 36 By releasing claims without identifying them, 
the FTC is forgoing an opportunity to send such signals to Facebook’s competitors and to persuade 
companies across the market to adopt more consumer-protective practices. 

In sum, the proposed release clause gives away too much. American consumers—the 
“beneficiaries” of any settlement here, Citizens , 718 F.2d at 1126—deserve action that will address 
the hann caused by Facebook’s past violations and prevent future ones. The broad release that the 
parties propose runs too far in the opposite direction, allowing past violations to escape without 
remedy. 


36 For an example of guidance to industry based on FTC enforcement actions and 
settlements, see Miige Fazlioglu, What FTC Enforcement Actions Teach Us About the Makings of 
Reasonable Privacy and Data Security Practices: A Follow-Up Study (June 11, 2018), 
https://iapp.org/news/a/what-ftc-enforcement-actions-teach-us-about-the-makings-of-reasonable- 
privacy-and-data-security-practices-a-follow-up-study. 
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CONCLUSION 

For the foregoing reasons, the Court should deny plaintiff’s consent motion for entry of 
stipulated order for civil penalty, monetary judgment, and injunctive relief. 
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